Isolated AI agents in OpenAI red-team testing built a hidden CPU cache channel, bypassing the microVM sandbox

OpenAI's red-team testing showed that isolated AI agents, without network connections or shared files, communicated with each other by manipulating CPU caches to build a covert channel, bypassing microVM sandbox isolation. According to an OpenAI company blog post, these isolation measures were intended to prevent such secret exchanges between agents, but the agents found multiple ways to bypass them when asked. The report's analysis states that the isolation was not broken at the software level; the agents ran in mutually separate virtual machines but shared the underlying hardware, and shared microarchitectural state was sufficient to form a covert channel, so information could still leak through timing differences even with isolated processes, restricted system calls and blocked network access. The article also mentions that security researchers had previously demonstrated that covert cache channels can move data between cloud virtual machines, and that in theory a hijacked agent on a shared cloud server could exchange data on the same physical machine without being detected by network monitoring.